Hunt List
13,080 network-exploitable high/critical CVEs ranked by bug bounty relevance. Sorted by attack surface, exploit availability, and exploitation probability.
| BB | CVE | CVSS | EPSS | Attack Surface | Flags | Description |
|---|---|---|---|---|---|---|
|
80
|
CVE-2026-60366 |
10.0 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-49767 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | |
|
80
|
CVE-2026-60367 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-60372 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
80
|
CVE-2026-66662 |
9.8 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 | |
|
79
|
CVE-2026-101986 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | An Improper Authentication vulnerability in J-Web of Juniper Networks Junos OS | |
|
79
|
CVE-2026-35503 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | A vulnerability in SenseLive X3050’s web management interface allows authenticat | |
|
79
|
CVE-2026-59099 |
9.3 | 0.0055 | NET NO AUTH LOW CX NO UI | Apereo CAS 7.3.0 before 8.0.0-RC6 contains a cryptographic vulnerability that al | |
|
78
|
CVE-2026-73381 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | |
|
78
|
CVE-2026-42856 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the | |
|
78
|
CVE-2026-14161 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure | |
|
78
|
CVE-2026-73523 |
8.7 | 0.0055 | NET NO AUTH LOW CX NO UI | COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in ac | |
|
78
|
CVE-2023-54203 |
9.1 | 0.0055 | NET NO AUTH LOW CX NO UI | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix | |
|
77
|
CVE-2026-112893 |
8.2 | 0.0055 | NET NO AUTH LOW CX NO UI | Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an | |
|
75
|
CVE-2026-57876 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An unauthenticated out-of-bounds write vulnerability exists in onvif.cgi in GeoV | |
|
75
|
CVE-2026-36478 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to | |
|
75
|
CVE-2026-9171 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM WebSphere Application Server and WebSphere Application Server Liberty are vu | |
|
75
|
CVE-2026-14979 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim F | |
|
75
|
CVE-2026-46600 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value | |
|
75
|
CVE-2026-16308 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3. | |
|
75
|
CVE-2026-16931 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of | |
|
75
|
CVE-2026-17271 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of | |
|
75
|
CVE-2026-71675 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of servic | |
|
75
|
CVE-2026-16690 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16706 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16817 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16818 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16824 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16831 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16836 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16852 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-16924 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17121 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17159 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17163 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17165 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-17170 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c | |
|
75
|
CVE-2026-102486 |
7.5 | 0.0055 | NET NO AUTH LOW CX NO UI | Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1 | |
|
70
|
CVE-2026-57331 |
9.9 | 0.0055 | NET LOW CX NO UI | Performer Arbitrary File Deletion in Paid Videochat Turnkey Site <= 7.4.8 versio | |
|
70
|
CVE-2026-57401 |
9.9 | 0.0055 | NET LOW CX NO UI | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') v | |
|
68
|
CVE-2026-22622 |
8.8 | 0.0055 | NET LOW CX NO UI | Improper input validation in one of the session management interface of Eaton's | |
|
68
|
CVE-2026-71288 |
8.8 | 0.0055 | NET LOW CX NO UI | Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter | |
|
68
|
CVE-2026-71291 |
8.8 | 0.0055 | NET LOW CX NO UI | Bolt CMS renders content field values through Twig's full application-level Envi | |
|
68
|
CVE-2026-60368 |
8.8 | 0.0055 | NET LOW CX NO UI | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion | |
|
67
|
CVE-2026-8100 |
8.6 | 0.0055 | NET LOW CX NO UI | Impact A security issue has been identified in Chef 360 that could allow unauth | |
|
66
|
CVE-2026-8147 |
8.1 | 0.0055 | NET LOW CX NO UI | In MLflow versions prior to 3.14.0, when running with authentication enabled, th | |
|
65
|
CVE-2026-63414 |
7.6 | 0.0055 | NET LOW CX NO UI | Shopify App is a Rails engine for building Shopify applications. From 22.1.0 unt | |
|
64
|
CVE-2026-47110 |
7.1 | 0.0055 | NET LOW CX NO UI | Tiptap for PHP before version 2.1.1 contains an input validation vulnerability t | |
|
62
|
CVE-2026-75855 |
8.4 | 0.0055 | NET LOW CX NO UI | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api | |
|
58
|
CVE-2026-58592 |
8.9 | 0.0055 | NET NO AUTH | Ladybird before commit 2f9dc7e contains a dangling-reference memory-safety flaw |